Properly escape all relevant html entities

Avoid problems with files named things like '<img>' and so on.
v0.3.1