fix html entites decode security issue