avoid some XSS, but there's more.