Merge pull request #27 from shivrai/fix/escape_html

Enable HTML escaping for code segments

templates/cards.html

@@ -57,7 +57,7 @@
                     {% if card.type == 1 %}
                         {{ card.back|replace("\n", "<br />")|safe }}
                     {% else %}
-                        <pre><code>{{ card.back|safe }}</code></pre>
+                        <pre><code>{{ card.back|escape }}</code></pre>
                     {% endif %}
                 </td>
             </tr>

templates/memorize.html

@@ -47,7 +47,7 @@
                                     </div>
                                 {% endif %}
                             {% else %}
-                                <pre><code>{{ card.back|safe }}</code></pre>
+                                <pre><code>{{ card.back|escape }}</code></pre>
                             {% endif %}
                         </div>
                     </div>