fix the XSS vuln by using format_html