Fixed a potential XSS vulnerability.

Thanks JPCERT for reporting it to us.