Escape HTML special characters, not yet tested (ref gh-3).