use html escape and not uri escape