Escape HTML via helper. Return string instead of null.