APP-122 escape strings for html insertion

to prevent xss
fix misspelling