Added escaping to the report_type
Added escaping to all the variables used in html