Fix: use CGI.escapeHTML() to prevent injection