replace htmlspecialchars with esc method