Correction: escape HTML in code