For this and all other HTML that you generate, have you considered using the tag functions? Not only is it more readable, but by default it escapes text.