added filename and HTML escaping