escape tags so it is safe from xss