replace links and escape html on the server