HTML-escape the four characters that matter in text and attribute values.