pre_escape html to prevent injection

replace #12 by just fixing the bug.