[fix] html escape