Let's profit of this time to add the maybe-not-necessary-but-feel-safer calls to Utils.escapeHTML in the various parts where we concatenate HTML strings here.

_or_ switch to Rick's Utils.Template micro-library.