blocked XSS attacks, really hard to trust this little bitty piece of code, but inputting raw HTML is definitely not necessary so at least it's easy.