pre_escape html to prevent injection