HTML entities are escaped