remove dirty hack and escape html instead