Fixed security / correctness issue where HTML wasn't correctly escaped