Use Mozilla's escapeHtml() instead.