build output html more safe way