Fix query string injections Aug 23