Fixed html/script injection issues (thanks iostream!)