move config to config file, remove stupid html injection bug