use escape-html for HTML escaping