def html_escape(s):
    """Return string with all html escaped.
    This is also safe for javascript in html but not necessarily correct.
    """
    return s.replace('&', '&amp;').replace('>', '&gt;').replace('<', '&lt;'
        ).replace('"', '&quot;').replace("'", '&apos;')
