Fix XSS vulnerability

I guess these are not really the only ones, but these fields should not be vulnerable anymore at least. Example of abuse of this vulnerability = poke me.