fix: should escape HTML entities to prevent injection (issue #24)