Html: Start to put call to the function hesc() around anything outputting to html, including rendering functions.  Also, move the final if out of the html that will act as the template.