fixed not escaping HTML special chars