added CGI escape to update_cb