No longer escapes HTML. Caller needs to do that