fixed XSS for non existing bib files
comment + more reasonable variable name
only escape html output to (theoretical) support special characters in
file names
Merge pull request #1 from arnehaber/xss_fix

Xss fix