Fix URL injection vulnerability.