Properly escape file names, titles, and descriptions

Hacker One report# 30019