HTML escape the decal file name just in case it contains & or other
illegal characters.