html escape fix