fix bug: html tags get escaped