Escape usage of `$current_url`

To prevent XSS, use of `$current_url` needs to be properly escaped