fixed html escape