Fix potential XSS in error message

Reported by @mashimonator