Properly sanitize user input for the "alt" text.

I'm not totally certain why you use alt text as the basis for dom id (instead of just a random string), but if you do it, at least sanitize the string first.