fixed html entity escaping