fix(escape html) escape html for content we do not control