diff --git a/abrechenbarkeit.lua b/abrechenbarkeit.lua
index 2cf0ba3..be60a18 100755
--- a/abrechenbarkeit.lua
+++ b/abrechenbarkeit.lua
@@ -22,6 +22,7 @@
 local matchers = {
     time = "(%d+)",
     user = "([%w_@ -]+)",
+    user_opt = "([%w_@ -]*)",
     amount = "(-?%d+)",
     amount_opt = "(-?%d*)",
     comment = "([%w_ -]+)",
@@ -50,7 +51,7 @@ end
 local function urlencode(s)
     if s == nil then return nil end
     return s:gsub("[^%w]",
-        function(cap) return string.format("%02x", string.byte(cap, 1)) end)
+        function(cap) return string.format("%%%02x", string.byte(cap, 1)) end)
 end
 
 local function parse_query(q)
@@ -255,7 +256,7 @@ local function read_products()
         if l == "" or l == nil then
             return nil
         end
-        local barcode, price, user, name = string.match(l, format("^{barcode},{amount},{user}?,{name}$", matchers))
+        local barcode, price, user, name = string.match(l, format("^{barcode},{amount},{user_opt},{name}$", matchers))
         return barcode, tonumber(price), user, name
     end
 end
@@ -326,7 +327,7 @@ local function r_transaction_post()
             if p_barcode == pcode then
                 pcount = (tonumber(data.pcount) or 1) * (data.negate_pcount ~= nil and -1 or 1)
                 amount = amount or pcount * p_amount
-                user_dst = user_dst or p_user
+                user_src = user_src or p_user
                 comment = comment or
                     string.format("%s %d %s", pcount < 0 and "Buy" or "Restock", math.abs(pcount or 0), p_name)
                 exists = true
@@ -469,7 +470,7 @@ local function r_log(filter)
                 print(format([[
                     <tr>
                         <td>{time} ({time_delta})</td>
-                        <td>{user_src} → {user_dst}</td>
+                        <td><a href="/{user_src_url}">{user_src}</a> → <a href="/{user_dst_url}">{user_dst}</a></td>
                         {amount}
                         <td>{pcode}</td>
                         <td>{pcount}</td>
@@ -491,6 +492,8 @@ local function r_log(filter)
                     time_delta = format_duration(os.time() - time),
                     user_src = escape(user_src),
                     user_dst = escape(user_dst),
+                    user_src_url = urlencode(user_src),
+                    user_dst_url = urlencode(user_dst),
                     amount = format_amount(amount, "td"),
                     pcode = escape(pcode),
                     pcount = (pcount and (pcount < 0 and "buy " or "stock ") or "") ..
@@ -519,7 +522,7 @@ local function r_index()
         print([[<div class="userlist"></div>]]) -- for printing
         print([[<ul class="userlist">]])
         for _, user in ipairs(get_active_users()) do
-            if user.name.sub(1, 1) ~= "@" then
+            if user.name:sub(1, 1) ~= "@" then
                 print(format([[<li>
                     <a href="/{username_url}">
                         <span class="name">{!username}</span>
@@ -636,7 +639,7 @@ local function r_products()
                 name = name,
                 price = format_amount(-price, "td"),
                 barcode = barcode,
-                count = pbals[barcode] or "0",
+                count = tostring(pbals[barcode] or 0),
                 user = user,
             }))
         end