2 3 stable

update output_safety.rb to use the decimal HTML escape code for single quotes instead of the hex one, so webkit-based browsers properly translate and display the code in form fields