Make sure we replace all instances of each character to be escaped.

src/crate/util.cljs

@@ -20,11 +20,11 @@
 (defn escape-html
   "Change special characters into HTML character entities."
   [text]
-  (.. (as-str text)
-    (replace "&"  "&")
-    (replace "<"  "&lt;")
-    (replace ">"  "&gt;")
-    (replace "\"" "&quot;")))
+  (-> (as-str text)
+    (str/replace "&"  "&amp;")
+    (str/replace "<"  "&lt;")
+    (str/replace ">"  "&gt;")
+    (str/replace "\"" "&quot;")))
 
 (defn to-uri
   "Prepends the base-url to the supplied URI."