Properly escape data for injection into HTML

My debug output was getting interpreted as HTML. No good. This fixes it what you see is always the same as what you echoed.