be safe with htmlbars