escape HTML for XML code pasting