HTML escaping content

this fixes xss vulnerability, or at least i hope so