all prepared content should go through htmlentities()