Fix a potential XSS.

Use

    fn main() {
    let _ = "<img src="https://www.google.it/images/srpr/logo11w.png" onload="alert('')" \/>";
    }

and compile clicking either asm or ir to trigger. 

As an alternative, how about using a client side highlighter?
Pygments does this escaping for us, so I think only the change to the JavaScript is necessary.