XSS fix in channel linking (courtesy of dispols)