Make sure user input is escaped before passing it around as HTML