Escape tags for display instead of emitting it as raw HTML

As the user should not be able to enter <textarea> to break things badly
Merge pull request #132 from chkwok/master

Escape tags for display instead of emitting it as raw HTML