fixed html escaping bug