Escape html output (perhaps uselessly given the lack of trust issue)
Add error handling to data fetching