escape html when appending