string: Escape all HTML’s metacharacters.