fixed escaping of html