fix html escaping