security update

escaping post requests, sanitizing, etc.