Escape HTML output

[vanschelven]

As per Django's documentation

Clearly, user-submitted data shouldn’t be trusted blindly and inserted
directly into your web pages, because a malicious user could use this kind of
hole to do potentially bad things. This type of security exploit is called a
Cross Site Scripting (XSS) attack.

To avoid this problem, you have two options:

• One, you can make sure to run each untrusted variable through the escape
  filter (documented below), which converts potentially harmful HTML characters
  to unharmful ones.

[matthewhegarty]

Hi Klaas - thanks so much for raising the issues and suggesting PRs, we appreciate it. I would recommend you test against v3 which is in beta (branch is release-3-x).

There are a lot of changes coming in v3. You'd be very welcome to submit PRs in either v2 or v3, but please check out the contribution guide first. v3 is going to soon become the mainline version, with v2 supported for some time for bug fixes.

[vanschelven]

This particular PR does not apply on release-3-x; given its nature, might I suggest merging it into master anyway?

[vanschelven]

@matthewhegarty anything I can do to move this PR and the others forward?

[matthewhegarty]

I'll have to take a look when I get some time - maybe at the weekend. Thanks for your contributions.

[matthewhegarty]

Thanks again for submitting this. I fixed the isort error and updated changelog. If you are ok with that I will merge.

[coveralls]

Coverage remained the same at 98.397% when pulling 2c6cd3e on vanschelven:escape-html-output into a0b4dfc on django-import-export:main.

[vanschelven]

LGTM, feel free to merge

[vanschelven]

@matthewhegarty any chance you could release 2.8.1 to include this PR (and a few others) in a proper release?

[matthewhegarty]

2.9.0 released