escape <>'s