add html escape function for filtering html