CGI.escapeHTML()
fake URI for indeed