Do not allow Cross Site Scripting attacks

If you add a entry like 
[field] = "<script>alert('XSS Attack');</script>" to a document, the Javascript is executed. This change should fix the issue.