StringUtils.htmlEscape is deprecated now, using _.escape instead.