Escape external data in demo apps

It seems that WePay sanitizes its data in some way. But all external data should be escaped anyway in a good application written defensively. Moreover, WePay returns & as & so we need to escape at least that to get a valid XHTML.

A PHP application must specify its output encoding to allow escaping functions work properly so I've done also that. If Unicode character set is used then htmlspecialchars() escapes all we need and htmlentities() is not required as it escapes even characters that don't need any escaping.