add css-escape to avoid jquery based xss