add htmlspecialchar to output html code