Fixes #6708 escape tag strings correctly with option to restrict html input