fix XSS security vulnerability

(Thanks to Stefan Schurtz!)