Fix formspec injection issues