missing hsc() call

I assume this was missing as it is included in the same call on line 921, and this function wouldn't do any escaping otherwise.