escape HTML characters
escape html entiries