fixxed html escape function