we still need to escape the photoURL; this won't hurt, and imho this is necessary because this is an external input.