Escaping html to prevent JS injections.