HTML-escape strings.