Change cgi to html, since cgi.escape is deprecated
Fix a bug in hash/unhashing