escape &, <, >