add DB install instructions
add escaping in views