Escape html for xml

Also needs to escape html entities for validity