Fix #11 and #12 by escaping enough to be safe in legacy browsers

This is a WIP, do not merge.