CRITICAL BUG: Fix ALL POSSIBLE XSS with a HTML encoder