Properly escape HTML in examples and messages

Without this change, example input/output is interpreted as HTML markup instead of as text.