https://peterkellner.net/2006/11/22/encodehtmlwithsecurity/