html-inject-vuln: Backport escape html for inline discussions

@chrisndodge FYI. Tested locally, this prevents the issue.