query string html escaping fix