diff --git a/TODO b/TODO
index 26ae52f..55f67fa 100644
--- a/TODO
+++ b/TODO
@@ -1,5 +1,4 @@
-input validation to avoid XSS and injection
 only allow signup, login ecc over HTTPS
 session expiration
 mark cookies as secure
-consider SameSite=Strict
\ No newline at end of file
+consider SameSite=Stricts
\ No newline at end of file
diff --git a/pages/index.wl b/pages/index.wl
index 073ffdd..8b57624 100644
--- a/pages/index.wl
+++ b/pages/index.wl
@@ -55,10 +55,10 @@ let main =
 
             <div class="item">
                 <div>
-                    <a href=\'"'\link\'"'>\post.title</a>
+                    <a href=\'"'\link\'"'>\escape(post.title)</a>
                 </div>
                 <div>
-                    <span>\post.date</span> | <span>\post.num_comments comments</span>
+                    <span>\escape(post.date)</span> | <span>\escape(post.num_comments) comments</span>
                 </div>
             </div>
         }
diff --git a/pages/page.wl b/pages/page.wl
index ce90bf9..131bc04 100644
--- a/pages/page.wl
+++ b/pages/page.wl
@@ -3,7 +3,7 @@ procedure page(title, login_user_id, style, main)
     <html>
     <head>
         <meta charset="UTF-8" />
-        <title>CN - \title</title>
+        <title>CN - \escape(title)</title>
         <style>
             body {
                 line-height: 200%;
