Update README.md

escape HTML