Use OC's p() function instead of echo commands for better xss protection.