Escape special html characters (to avoid XSS)