forgot to html_safe string