Porting over fix for HTML injection exploit from /tg/