def escape_html(text, escape_quotes=False):
text = text.replace('<STR_LIT:&>', '<STR_LIT>')<EOL>text = text.replace('<STR_LIT:<>', '<STR_LIT>')<EOL>text = text.replace('<STR_LIT:>>', '<STR_LIT>')<EOL>if escape_quotes:<EOL><INDENT>text = text.replace('<STR_LIT:">', '<STR_LIT>')<EOL>text = text.replace("<STR_LIT:'>", '<STR_LIT>')<EOL><DEDENT>return text<EOL>
Escape all HTML tags, avoiding XSS attacks.
    < => &lt;
    > => &gt;
    & => &amp:
    @param text: text to be escaped from HTML tags
    @param escape_quotes: if True, escape any quote mark to its HTML entity:
                          " => &quot;
                          ' => &#39;