Prevent possible XSS attack vectors

Note: the `h`-escapes are not necessary needed in the `html_title` because the base layout already `h`-escapes the `html_title`, but better be sure should this change in the future.