escape html of user input during uploads