Use _.escape()

Instead of the deprecated `StringUtils.htmlEscape()` function.