escapes html characters in email