fix: escape html in url title