fixed bug that allows html injection when input AI/Player names