Sanitised user input
Interpolated values are now HTML-escaped
Escaped the variables that remained
Merge pull request #77 from Coenego/issue-77-user-input

Sanitise user input before using it in the UI