Corrected a few serious escaping bugs.

None of the replacements in the escaping functions were global, and
non-interpolated string content wasn’t escaped at all.