bug fix: html escape