updates to escape html and xml chars