Properly escape HTML

It is much better to let the stdlib CGI module do the HTML escaping instead of redoing it. Also, the previous code did not properly escape `&` and other chars.