escape data in tpls
add sessions