Fix XSS vulnerability. Closes #1922