review: escaped all untrusted HTML