Input is now properly sanitized before being returned to the user. This prevents a remote cross site scripting attack in which a user could create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server.