Fix for XSS code injection

I am unable to test the code since I'm on my iPad. You should verify that it works before deploying and/or using for demos.