Closes #43, was a case of not escaping html when dynamically creating html! Doh!