escape html in merge vars