Prevent XSS by escaping potential HTML