Security fix

Passed the value of the size parameter straight to the output without
validating, leaving an xss hole. This should fix that issue.

Change-Id: Iead26a54a34babe1b580d64d98fff2357e5731e5