fix bug in html escaping