fix: missing HTML escapes