Fix entity escaping on main pages

DOMDocument::createElement() expects HTML input while it used to receive
entity-deoded text. As a result, there's no XSS only because Parser sanitizes
input enough to prevent anything stupid. In addition to potential insecurity,
this bug also generated PHP warnings for some inputs.

Change-Id: If917097f97d0239aa2ebdeabe863b5786e92230c
Merge "Fix entity escaping on main pages"