Incremental fix for Bug 2847, Use HTML escape in templates where appropriate