monitor: prevent html injection with cgi.escape