validating text should escape html