updated user input to be sanitized to prevent basic JS script injection