Escape HTML and JS in wallposts and reactions.

BB-130 #resolve #comment This is now fixed and can be tested on the dev server.