By default, those fields are escaped. Also, all the data requests go through a admin review process before they become publicly accessible.