Update erik.py

escape html special chars so we show <, >, & and we can't be javascript injected