All echo'd data is now escaped. The checkboxes are now echo'd with apropriate data.  Still needs to be bug checked.