Update PCO.js

A simple efficient way to solve that fits well with the current code is to first use

.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;") 

to block cross site scripting.

Then the regexes after that should be updated to match &lt;, &gt; rather than < and >.

I've made a test case that verifies the cross site scripting vulnerability, written the fix I propose and tested that it does solve the problem while color tags and urls still work.