Escape HTML special characters safely.