make sure we use html_escape / html_purify correctly