Fixing a reflected XSS