It seems like it's not auto escaping right