fixed cross site scripting on the username and name field by encoding the output