Properly encode HTML special characters

[Marcel]

In cursory testing, it seems special characters aren't escaped so the output doesn't work as an href value when these are used.

[Michael McKeever]

Thanks for pointing that out. It should be fixed now.