escape pre tag in xss.py