escape html chars in posted destination