properly escape content for HTML output