todo: investigate sanitising user input
escape html