Prevent javascript: injection