added escaping function for attributes and textarea

escape all dynamic data output to the front end with the appropriate functions
also escape the textarea