Escape user input

Didn't escape `markdown` because it is handled by marked at frontend.