bugfix Escape HTML