Media: Escape HTML

\cc @karlitschek @Raydiation