xss escaping and parsing html entities