Escape the things

We need to escape the "disabled" attribute. And apparently the Paypal
string has never used the right i18n function