-<% lon = params['mlon'] %>
-<% lat = params['mlat'] %>
-<% zoom = params['zoom'] || '12' %>
-<% layers = params['layers'] %>
-<% elsif cookies.key?("location") %>
-<% lon,lat,zoom,layers = cookies["location"].value.first.split(",") %>
+<% lon = h(params['mlon']) %>
+<% lat = h(params['mlat']) %>
+<% zoom = h(params['zoom'] || '12') %>
+<% layers = h(params['layers']) %>
+<% elsif cookies.key?("_osm_location") %>
+<% lon,lat,zoom,layers = cookies["_osm_location"].split("|") %>