Use jinja2 escape filter on user-generated badge metadata on Facebook share form to prevent XSS attacks.