Fix XSS vulnerability in links