move set of $this->resource to findController and add htmlspecialvars in the echo to prevent xss