XSS Fix

Prevent another XSS; not 100% sure the technique is right, but seems to
work.