Do we need to escape all these fields that were entered by users?