avoid re-escaping HTML