fixed bug that allows html injection when input AI/Player names

Found a small bug that allows html injection when inputting player/AI names. For example, typing '<input>' resulted in an input box appearing as the name. With this fix, '<input>' would result in the name just being '<input>'