escape tags before displaying them