HTML entities be escaped