escapeHTML in all dynamically generated variables.

Fixes #12