diff --git a/get_stories.php b/get_stories.php
index 3c82e38..c33fae0 100644
--- a/get_stories.php
+++ b/get_stories.php
@@ -71,6 +71,7 @@ public static function nprstory_cron_pull() {
 
     function load_page_hook() {
 		// find the input that is allegedly a story id
+		// We validate these later
         if ( isset( $_POST ) && isset( $_POST[ 'story_id' ] ) ) {
             $story_id =  $_POST[ 'story_id' ] ;
             if ( isset( $_POST['publishNow'] ) ){
diff --git a/get_stories_ui.php b/get_stories_ui.php
index 3c2bf3a..71ffa37 100644
--- a/get_stories_ui.php
+++ b/get_stories_ui.php
@@ -107,7 +107,7 @@ function nprstory_get_stories() {
 						if ( ! $pull_url ) : nprstory_show_message ('You do not currently have an API Pull URL set.  <a href="' . admin_url('options-general.php?page=ds_npr_api') . '">Set your API Pull URL here.</a>', TRUE);?>
             <?php endif;
 
-			// Get the story ID from the URL, then paste it into the input
+			// Get the story ID from the URL, then paste it into the input's value field with esc_attr
             $story_id = '';
             if ( ( isset( $_POST ) and isset( $_POST[ 'story_id' ] ) ) || ( isset( $_GET) && isset( $_GET['story_id'] ) ) ) {
                 if ( ! empty( $_POST['story_id'] ) ){