Use html_escape to quote ui_textbox name / value HTML attributes
Use encodeURIComponent() instead of escape()

Reasons being:
- escape() is deprecated.
- escape() uses non-standard %u encoding, which isn't decoded properly by chooser.cgi.
- encodeURIComponent() uses UTF-8, which isn't decoded properly by chooser.cgi either,
  but at least is has a chance of matching the page / filesystem encoding and working
  properly.