[security] encode quoting chars in HTML and XML