html escape data before it is rendered instead of before it is saved