Fix XSS injection

The escapeMarkup function now escapes more than just the ampersand. It now escapes html tags, quotes and slashes as well. It is also applied to strings before the library adds html to it.