escape HTML in bufferlines