--- a/includes/common.php	Tue Nov 16 12:44:22 2010 -0500
+++ b/includes/common.php	Tue Jul 12 22:13:37 2011 -0400
@@ -190,7 +190,7 @@
       unset($_COOKIE['sid']);
       setcookie('sid', '', time()-3600*24, scriptPath);
       setcookie('sid', '', time()-3600*24, scriptPath.'/');
-      die('Session cookie cleared. <a href="'.$_SERVER['PHP_SELF'].'">Continue</a>');
+      die('Session cookie cleared. <a href="'.htmlspecialchars($_SERVER['PHP_SELF']).'">Continue</a>');
       break;
   }
 }