make string html safe.