fixed input escaping using mustache