Replacing '&' and '<' with HTML entities