render: string escaping done right