Fixed escapeHtml function to actually escape the html.