fix #36391: Escaping html characters