fixed html escaping, and BAD string eval