The HTML needs to be escaped before it's inserted into `<code>`, otherwise it will execute the widget code again.  This function escapes it on the fly before appending.