adding HTML escaping. bug fix