html escaping, replace alert with username div