added string.escapeHTML()