rewrote almost everything to eliminate a security flaw allowing HTML injections