added some xss protections and ditched eval() function