HexToASCII: encode chars in html, avoid xss

avoid potential xss.