fixed bypass with HTML entities