changed flash message
escape html from form