Add the htmlEncode function, preventing the XSS.