add escaping to html