use escape instead of format_html