fixed #3 Escape strings for HTML output