This Fixes #788

Used _.escape(string)  from underscore.js to escape a string for insertion into HTML, replacing &, <, >, ", `, and ' characters. 
@gordonwoodhull This is fixed please review.