Properly escape data for injection into HTML

My debug output was getting interpreted as HTML. No good. This fixes it so that what you see is always what you echoed.