escape string when rendering html from markdown