escape HTML to prevent XSS attacts