rearranged order of chars to make the escaping safer (no escaping of & on escape-results)
test HTMLEscape