Protect against XSS on index.php

Not sure why we had a plain-as-day $_GET just sitting there without any character obfuscation or whatnot.