escaping html (thanks @fabienwang xD)