more complete html escaping