Use HTML escaping routines in more places.