sanitize src param

The src param can be used for XSS. Here's a fix to sanitize it.