Fixed: Should not have completely disabled the HTML escape function. Must always escape &,<,>.