Add XSS escaping (I should have done that in the first place)