run inputs through Y.Escape.html