escape < and > in card and attachment names