Added escapeHTML to prevent script tags

Added escapeHTML to prevent script tags