fixed escaping html