Document escaping HTML, script injection. Fixes #23