use html_escape
escape comment body migration
TODO: should not double/triple escape the body