I think we can just use html, and just be more careful above about what we allow in. Only prompt_number is input, and we can verity that it's an integer, which is perfectly safe. No need for these shenanigans.