Improve escapeHTML

Replacing one char after another is not a best practice, due to the order dependency of replacing, xss risk and performance.

Fix #1577

srcjs/utils.js

@@ -1,10 +1,16 @@
 function escapeHTML(str) {
-  return str.replace(/&/g, "&")
-            .replace(/</g, "&lt;")
-            .replace(/>/g, "&gt;")
-            .replace(/"/g, "&quot;")
-            .replace(/'/g, "&#039;")
-            .replace(/\//g,"&#x2F;");
+  var escaped = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#039;",
+    "/": "&#x2F;"
+  };
+
+  return str.replace(/[&<>'"\/]/g, function(m) {
+    return escaped[m];
+  });
 }
 
 function randomId() {