only escape html output to (theoretical) support special characters in
file names