need to HTML-escape the variable string values used in here