prevent xss by escaping special characters
bug fixes