use cgi.escape to prevent xss atack