                <account_code>#{data.accountCode}</account_code>
                <username>#{data.username}</username>
                <email>#{data.email}</email>
-               <first_name>#{data.firstName}</first_name>
-               <last_name>#{data.lastName}</last_name>
+               <first_name>#{escape data.firstName}</first_name>
+               <last_name>#{escape data.lastName}</last_name>
 
                <billing_info>
                  <number>#{data.cardNumber}</number>

xml2js = require 'xml2js'
https  = require 'https'
S      = require 'string'

unescapeHTML = (html)->
  html
  # S(html).decodeHTMLEntities().s

createId = require 'hat'
getUniqueId = -> createId 64

    else
      callback no, res

setBilling = (accountCode, data, callback) ->
  # Remove credit card number if it's not updated
  if data.cardNumber? and data.cardNumber.indexOf('...') > -1 or data.cardCV? and data.cardCV == 'XXX'
    delete data.cardNumber
    delete data.cardCV

  # See https://docs.recurly.com/api/account for XML format
  xml = """<?xml version="1.0" encoding="UTF-8"?>
            <billing_info>
             <number>#{data.cardNumber}</number>
             <verification_value>#{data.cardCV}</verification_value>
             <month>#{data.cardMonth}</month>
             <year>#{data.cardYear}</year>

             <first_name>#{escape data.cardFirstName}</first_name>
             <last_name>#{escape data.cardLastName}</last_name>
             <address1>#{escape data.address1}</address1>
             <address2>#{escape data.address2}</address2>
             <city>#{escape data.city}</city>
             <state>#{escape data.state}</state>
             <zip>#{data.zipCode}</zip>
             <country>#{escape data.country}</country>

             <ip_address>#{data.ipAddress}</ip_address>
            </billing_info>"""

  recurlyPut "accounts/#{accountCode}/billing_info", xml, (err, res) ->
    if err
      callback err, {}
    else
      callback no, res

setAccountWithBilling = (accountCode, data, callback) ->
  # Remove credit card number if it's not updated
  if data.cardNumber? and data.cardNumber.indexOf('...') > -1 or data.cardCV? and data.cardCV == 'XXX'
