added html & script escapings