Properly escape HTML characters/bytes