more validation fixes
escape output var in js