prevent XSS, added approve/edit/remove, fixed rating formula