Ensure that all MakeClicky replacement strings escape their user-supplied content, to prevent XSS
Merge branch 'security/2.6/escape-makeclicky' into 2.6-trunk