Don't we need to html escape the values?