html escaping bugfix