yeah, I rather stupidly didn't think to add any XSS protection initially because this was a simple tech demo. And yes, I managed to balls up the regex for a while.

It's working nicely again now.