Oops - fix XSS introduced in last version

Should have tested that more carefully; turns out I made things worse.  This should fix it.

Maybe if you want I should instead rewrite it to the unescape-then-re-escape everything methodology, but you should either revert the previous or get this fix out ASAP.