web: Use a htmlspecialchars() wrapper instead of htmlentities(), force UTF-8

PHP < 5.4.0 use ISO 8859-1 instead of UTF-8 by default for both
htmlentities() and htmlspecialchars(), and we are a Unicode application.

I chose to replace htmlentities() with htmlspecialchars() to avoid
wasting time substituting entities for Unicode characters that don't
have a special meaning in HTML.

Additionally, changed instances that do not need quote escaping so they
don't substitute " and '.