escape HTML in descriptions