properly escaped code in a handler