Why do we need to htmlEscape() the user input?