escape brackets (otherwise interpreted as HTML)