Proper step formatting, plus XSS protection