Fix possible xss by using .text instead of .html