escape html tags in code