Escape tags for display instead of emitting it as raw HTML

As the user should not be able to enter <textarea> to break things badly