Escape HTML

To prevent injection, the content is inserted with `jquery.text` instead of `jquery.html`.