Encode entities in the strings to avoid cross-site scripting.