Use .text() instead of .html() to prevent XSS