all input text escape html special characters