fixes typo in composer description
adds escaping to prevent xss