input sanitation

backend/utils.py

 from datetime import datetime
+from html import escape
 from secrets import token_hex
 
 from cryptography.exceptions import InvalidSignature
@@ -57,10 +58,10 @@ def update_item(db: Session, item: schemas.Item, data: schemas.ItemUpdate):
     verify = ""
     if data.addressee:
         verify += data.addressee
-        item.addressee = data.addressee
+        item.addressee = escape(data.addressee)
     if data.team:
         verify += data.team
-        item.team = data.team
+        item.team = escape(data.team)
     if data.amount:
         verify += str(data.amount)
         item.amount = data.amount