Properly escape HTML special characters unless as="html|xml"