We should do some basic XSS scrubbing of the link before printing it. Something that converts special characters, especially a `"`, just in case someone tries to inject a JS event handler somehow.