Function escapeHtml

Escape HTML special characters to prevent XSS while preserving valid pre-encoded entities. Used for both attribute values and text content.