diff --git a/js/playercontrols.js b/js/playercontrols.js
index ee099574..3bad2799 100755
--- a/js/playercontrols.js
+++ b/js/playercontrols.js
@@ -41,6 +41,12 @@ function initYoutubeControls(player)
 		newElem.appendChild(newChild);
 	}
 	container.appendChild(newElem);
+
+	newElem = document.createElement("div");
+	newElem.id = "bar";
+
+	container.appendChild(newElem);
+
 	initControls();
 	fitToScreen();
 	$("#mute").hover(function(){hoverMute(true)}, function(){hoverMute(false)});
@@ -155,6 +161,12 @@ function durationSetter()
 	minutes = Math.floor(currDurr / 60);
 	seconds = currDurr - minutes * 60;
 	document.getElementById("duration").innerHTML = pad(minutes)+":"+pad(seconds)+" <span id='dash'>/</span> "+pad(dMinutes)+":"+pad(dSeconds);
+	per = (100 / duration) * currDurr;
+	if(per >= 100)
+		per = 100;
+	else if(duration == 0)
+		per = 0;
+	$("#bar").width(per+"%");
 }
 
 function pad(n)
diff --git a/php/change.php b/php/change.php
index 5f4d596e..635d45f0 100755
--- a/php/change.php
+++ b/php/change.php
@@ -3,7 +3,7 @@
 $guid=substr(base64_encode(crc32($_SERVER['HTTP_USER_AGENT'].$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_ACCEPT_LANGUAGE'])), 0, 8);
 
 //save or delete(oid)                                             //getting the list we are in
-$list = explode("/", htmlspecialchars(strtolower($_SERVER["REQUEST_URI"])));
+$list = explode("/", htmlentities(strtolower($_SERVER["REQUEST_URI"])));
 if($list[1]==""||!isset($list[1])||count($list)<=1)$list="videos";
 else $list = preg_replace('/[^\da-z=?]/i', '', urldecode($list[1]));
 
diff --git a/static/controlstyle.css b/static/controlstyle.css
index 8e4f22d1..25f0e78e 100755
--- a/static/controlstyle.css
+++ b/static/controlstyle.css
@@ -162,3 +162,11 @@
 {
 	display:none !important;
 }
+
+#bar
+{
+	height:30px;
+	background-color:rgba(0,0,0,0.5);
+	/*-webkit-transition: width 2s;
+    transition: width 2s;*/
+}