fixing more xss

it’s a lot easier to fix if you just use triple brackets in the first
place. btw. you need to run composer update.