Manual HTML escaping