escapes html chars and other protections