Possible javascript injection fix PR

Fixes a bug that would allow for javascript injection into the editor.  Improves on a previous solution.