fixed cross site scripting on the username and name fields by encoding the output