1. use flask.escape to escape the nickname in order to  avoid the XSS