Passing the value of autostart and repeat parameters directly (as they were given by the user) leaves the door open for [XSS](http://en.wikipedia.org/wiki/Cross-site_scripting). XML Encoding may be needed. To be tested.