properly escape error messages displayed in HTML error pages