This seems prone to XSS injection. if a script tag got written. Can we convert to HTML entities on these strings before echoing them?

Should we be using some sort of JS formatting strings instead of concatenation for readability?