Protect against XSS attack.

Change-Id: I56a498d415ae708371237cf2255ab6e20939e25c