Fixing XSS

I found persistent and reflective XSS, so I might as well fix them for you :)

Please note, that since the code on this repo seems to be incomplete (lack of db-related files, not even sql schema!), I have no way to test it. If I could have tested it, I would have.