Escaped HTML entities on user defined strings

Escaped HTML entities on user defined strings, where appropriate.

This is a fix for issue #1208.