Added escaping for HTML and JS in create, edit, and index