Escape strings before injecting as html to prevent XSS attacks