Escaping GET variables in some places to protect against XSS