Better XSS without slash, more dangerous filenames.