fixed XSS vulnerability

Thank god the username is truncated, which kills most of the useful stuff you could do.
Also, fixed one unrelated HTML error.