bugfix html escape