Escape special HTML characters in user input to avoid script injection.