fix html evaluation, missing escape