use entity-escaped values for html and xml error outputs