escape some HTML