Escapes a string for insertion into HTML (server name)