only escape html when sanitizing