show.php: bugfix: #1

show.php: fixed XSS vulnerability