diff --git a/server/src/db.cpp b/server/src/db.cpp
index eee2cfe..c3b78aa 100644
--- a/server/src/db.cpp
+++ b/server/src/db.cpp
@@ -119,8 +119,6 @@ std::vector<Post> Database::getTopPosts(uint64_t amount) {
         int64_t timestamp = sqlite3_column_int64(stmt, 3);
         int64_t likes = sqlite3_column_int64(stmt, 4);
 
-        std::cout << userid << std::endl;
-
         // get username from id 
         std::optional<User> user = getUser(userid);
         if (!user.has_value()) {
diff --git a/server/src/main.cpp b/server/src/main.cpp
index 220a8c6..e3a035e 100644
--- a/server/src/main.cpp
+++ b/server/src/main.cpp
@@ -36,8 +36,6 @@ int main() {
 
     svr.Get("/", [&header, &footer, &database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
 
-        std::cout << "requested /" << std::endl;
-
         std::stringstream ss;
         ss << header;
 
@@ -61,8 +59,6 @@ int main() {
 
     svr.Post("/make_post", [&header, &footer, &database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
 
-        std::cout << "making a post at /make_post" << std::endl;
-
         std::string username = request.get_param_value("username");
         std::string password = request.get_param_value("password");
         std::string post = request.get_param_value("post");
diff --git a/server/src/post.cpp b/server/src/post.cpp
index 7840318..3e59a5a 100644
--- a/server/src/post.cpp
+++ b/server/src/post.cpp
@@ -1,23 +1,38 @@
 #include "post.h"
 #include <memory>
-#include <regex>
 #include <sstream>
 #include <string>
 #include <ctime>
 #include <maddy/parser.h>
 
-std::regex tags("<[^<]*>");
+void replaceAll(std::string& str, const std::string& from, const std::string& to) {
+    size_t start_pos = 0;
+    while ((start_pos = str.find(from, start_pos)) != std::string::npos) {
+        str.replace(start_pos, from.length(), to);
+        start_pos += to.length();
+    }
+}
 
-Post::Post(const std::string& contentin, const std::string& user) : user(user), time(std::time(nullptr)) {
+Post::Post(std::string contentin, const std::string& user) : user(user), time(std::time(nullptr)) {
+    replaceAll(contentin, "&", "&amp;");
+    replaceAll(contentin, "<", "&lt;");
+    replaceAll(contentin, ">", "&gt;");
+    replaceAll(contentin, "\"", "&quot;");
+    replaceAll(contentin, "'", "&apos;");
     // parse the post content markdown
-    std::stringstream input(std::regex_replace(contentin, tags, ""));
+    std::stringstream input(contentin);
     std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>();
     content = parser->Parse(input);
 }
  
-Post::Post(const std::string& contentin, uint64_t user) : userId(user), time(std::time(nullptr)) {
+Post::Post(std::string contentin, uint64_t user) : userId(user), time(std::time(nullptr)) {
+    replaceAll(contentin, "&", "&amp;");
+    replaceAll(contentin, "<", "&lt;");
+    replaceAll(contentin, ">", "&gt;");
+    replaceAll(contentin, "\"", "&quot;");
+    replaceAll(contentin, "'", "&apos;");
     // parse the post content markdown
-    std::stringstream input(std::regex_replace(contentin, tags, ""));
+    std::stringstream input(contentin);
     std::shared_ptr<maddy::Parser> parser = std::make_shared<maddy::Parser>();
     content = parser->Parse(input);
 }
@@ -37,6 +52,10 @@ std::string Post::genHtml() const {
     ss << content;
 
     ss << "<p class='postinfo'>" << likes << " likes</p>";
+    ss << "<div class='post-buttons'>";
+    ss << "<button onclick='like(" << id << ")'>Like</button>";
+    ss << "<button onclick='" << id << "'>Open</button>";
+    ss << "</div>";
 
     return ss.str();
 
diff --git a/server/src/post.h b/server/src/post.h
index f3e41d8..a368da3 100644
--- a/server/src/post.h
+++ b/server/src/post.h
@@ -18,8 +18,8 @@ struct Post {
 
     std::string genHtml() const;
 
-    Post(const std::string& contentin, const std::string& user);
-    Post(const std::string& contentin, uint64_t user);
+    Post(std::string contentin, const std::string& user);
+    Post(std::string contentin, uint64_t user);
 
     // Constructor for DB
     Post(