fixes a couple of found XSS flaws

I've not had chance to really get my head around the structure of the code so this is just a quick hack to get around the problem. There are a number of places where user generated content is outputted unescaped, which leads to an XSS vulnerability. 

I'd probably suggest creating a global wrapper function for all user outputs so its escaped by default, these were just two places I could easily perform the attack. 

See how I can call the console log here - http://markharding.withknown.com/2014/consolelogok#comments.