htmlEscape: add "'& characters as escape characters