Escape passed variables

Previously passed variables have not been escaped
and therefore this could lead to XSS attacks.

Additionally the indenting has been changed to
2 spaces.