fix xss vulnerability in output box

jquery .val() and .text() don't parse tags into DOM nodes.