text() insted html() to prevent script injection