Added escapeHtml() to redirect

Added escapeHtml() to the redirect parameter to prevent potential cross-site scripting.