to prevent injection attaches, javascript escape the user input