escape HTML before display index