escape html; fixed html_safe output