Escape HTML in heading