Moved wp_kses to check for allowed html in shortcodeHandler.
Add more escaping.