fixed html injection vulnarability by using escapehtml provided by apache jar
fixed merge