usage of nl2br; some basic xss protection

Just found that when I scanned the code. It's untested though, but it should work correctly.