use proper html escape