added some error checking to ensure no XSS