added escape html for queries