Fix XSS

This PR fixes XSS reported in #96 and #97.
I made the branch on next to fix it in a release as quickly as possible.

For the Challenge 9, since the form targets the current page, the `action` parameter is not needed.