More thorough security update + html escaping