use EscapeHTML() from PLP v3.23