Ensure that all MakeClicky replacement strings escape their user-supplied content, to prevent XSS