Do HTML escaping for strings