Re-implement html escaping without regex