html encodes strings for database