add htmlspecialchars to escape & characters to solve issue 374

[Nemo64]

This is not really a nice fix. It's just a search and replace for all createElement calls that adds htmlspecialchars everywhere

These were the patterns executed: createElement\(([^,()]+\,\s*)(\$([^,;()]+|\([^;()]*\))+)\) createElement($1($2) !== null ? htmlspecialchars($2) : null)