You need to escape the HTML code, using a package like escape-html.
Alternatively, you may want to use a simple implementation like:
const encodeHTML = (html) =>
html
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/'/g, ''')
.replace(/"/g, '"');