fix bugs: escape html