Xss inection

http://seclists.org/fulldisclosure/2014/Nov/3

$max_date was not washed