only html encode once