html encode user stuff and add timer