Fix for XSS vulnerabilities

Fixes different places where clean() wasn't used to prevent XSS attacks.