XSS fix was on the slow side and was breaking the case insensitive highl...

...ight. Went back to the original faster code but escape the String to prevent XSS