Add missing html escaping.

This should have been here the whole time. Many of these variables could
contain user input.