diff --git a/app/controllers/changeset_controller.rb b/app/controllers/changeset_controller.rb
index 9b09549d0..d69e7f4c1 100644
--- a/app/controllers/changeset_controller.rb
+++ b/app/controllers/changeset_controller.rb
@@ -349,9 +349,10 @@ class ChangesetController < ApplicationController
     if params['bbox']
        bbox = params['bbox']
     elsif params['minlon'] and params['minlat'] and params['maxlon'] and params['maxlat']
-       bbox = params['minlon'] + ',' + params['minlat'] + ',' + params['maxlon'] + ',' + params['maxlat']
+       bbox = h(params['minlon']) + ',' + h(params['minlat']) + ',' + h(params['maxlon']) + ',' + h(params['maxlat'])
     else
-      redirect_to :action => 'list'
+      #TODO: fix bugs in location determination for history tab (and other tabs) then uncomment this redirect
+      #redirect_to :action => 'list'
     end
        
     conditions = conditions_bbox(bbox);
diff --git a/app/views/changeset/list_bbox.rhtml b/app/views/changeset/list_bbox.rhtml
index 4f90d185b..63e54e11d 100644
--- a/app/views/changeset/list_bbox.rhtml
+++ b/app/views/changeset/list_bbox.rhtml
@@ -8,7 +8,7 @@ if @bbox!=nil
 
 	%>
 <p>
-Changsets within the area: 
+Changesets within the area: 
 (<a href='/?lat=<%= lat1 %>&lon=<%= lon1 %>&zoom=14'><%= format("%0.3f",lat1) -%>,<%= format("%0.3f",lon1) -%></a>) to 
 (<a href='/?lat=<%= lat2 %>&lon=<%= lon2 %>&zoom=14'><%= format("%0.3f",lat2) -%>,<%= format("%0.3f",lon2) -%></a>)   
 </p>
@@ -32,7 +32,19 @@ Changsets within the area:
 </table>
 
 <%= render :partial => 'changeset_paging_nav' %>
+<%
+	end
 
-<% end %>
+else 
+	#bbox is nil. happens if the user surfs to this page directly.
+%>
+
+<p>No area specified</p>
+<p>First use the <a href="/" title="view the map">view tab</a> to pan and zoom to an area of interest, then click the history tab.</p>
+<p>Alternatively view all <%=  link_to("recent changes", :controller => "browse", :action => "changesets") %> </p>
+
+<%
+end
+%>
 <br>
 <br>
diff --git a/public/javascripts/site.js b/public/javascripts/site.js
index d381c0231..06b4152df 100644
--- a/public/javascripts/site.js
+++ b/public/javascripts/site.js
@@ -62,8 +62,7 @@ function updatelinks(lon,lat,zoom,layers,extents) {
   if (node) {
     if (zoom >= 11) {
       var args = new Object();
-      //conjure a bounding box centred at the lat/lon.
-      //TODO: feed actual bounds of the window through to here somehow.
+      //set bbox param from 'extents' object
       minlon = extents.left;
       minlat = extents.bottom;
       maxlon = extents.right;