escaped install.php and added HTML purifier for future escaping needs