Prevent code injection into the profile picture URL