changed templates to prevent xss