added escaping for bad html user input