separated escape html into its own method