HTML-escape the passed value for template replacements