Fix a potential XSS