escape html-like chars from server