escape html for console logging