Fix: Potential URL hacking