forgot to escape html in one place
added a ticket cancel page
bad statement for setting soldout
oh yeah thats not how you escape html
this works now, fixed db bug