Escape html in requestor, user, and post sections prior to display