secure update, adding missing escapes to views