Fixed possible XSS in settings values