Fix a possible XSS