we need to escape the number too (because we'll generate a HTML string from it, and we probably won't sanitize it after that)