update templating system to escape inserted data