Added escape call for widget code block

We were seeing some confusion in the browser with id tags because the hidden code was not escaped.