blog does not escape html