You probably need to escape the userAnswer.
If it contains anything like < or >, then it will be interpreted as HTML right?