bugfix (XSS): use escapeing for replace HTML-code