Fix for double escaping, XSS (bug 865370)