feng - html_escape to prevent XSS