bugfix (XSS): use escapeing for replace HTML-code

we need escaping HTML-attributes, when we do modification HTML code

if need -- i will make example page, that show this bug (epic bug :)).

thanks in advance!