Fixed HTML escaping