escape <> chars