escape funky html chars