use text method instead of html

to avoid script injection