Escape HTML (caught by code standards)