user input validation and HTML escaping