use escape-html for escaping