Replace '&' and '<' with HTML entities