use html_escape for html generation