Escape < and > in escHtml to prevent stored XSS

src/main.cpp

@@ -391,6 +391,8 @@ static String escHtml(const String& s) {
     char c = s.charAt(i);
     switch (c) {
       case '&':  out += "&";  break;
+      case '<':  out += "&lt;";   break;
+      case '>':  out += "&gt;";   break;
       case '\'': out += "&#39;";  break;
       case '"':  out += "&quot;"; break;
       default:   out += c;