Fix the case where the matched strings contain HTML chars that need escaping

For the idea of what the issue is, 

Not working:
![2013-11-26-153319_965x309_scrot](https://f.cloud.github.com/assets/631797/1621020/a6209ba6-5684-11e3-95db-ef63552a3e79.png)

After the patch:
![2013-11-26-153435_969x353_scrot](https://f.cloud.github.com/assets/631797/1621024/b0692600-5684-11e3-98e1-0c3f9ca1bfa5.png)

Basically, I've used `CGI.escapeHTML` to escape the strings while sending back json data to browser.