fixed html escaping