HTML special char removal

prevention of XSS attacks now implemented (partially)