escapeHTML carsh if str is not "string"

[htchaan]

    var escapeHTML = function(str) {
        return str ? str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;") : str;
    }

[gwendall]

Fixed. b64dd69