escape <script> to `<script>` to not mess up page