Moved to escaped_image for LESS. Turns out still need quotes or LESS freaks out
Added malicious URL to test against
Adjusted escape function to properly escape all characters