feat(Mall Management): escape html