initial implementation of HTML escaping