adds escaping to prevent xss