replace remaining CGI.unescapeHTML call with basic_unescape_html