Fix XSS (thanks to Nick M)