Bug 25279: (QA follow-up) Use .escapeHtml