replace `CGI.escapeHTML` with `template.h`