actually use escapeHtml()