Closes #93

@stetard FYI

This is a classic issue of double encoding.

There are generally 2 parts to preventing XSS.

1. Going from user input to the database should keep the normal raw formatting but sanitize the input to remove anything unexpected. In the case of normal strings like names and titles, that can be done with HtmlUtils.StripTags which will remove any html/script tags and only return a plain string without any tags. For html content it is a bit more complex and I will explain later.
2. Encoding is the responsibility of the piece of code that deals with displaying that string, in this case we are dealing with webforms that goes directly into html, so we can use HtmlEncode, but that data could be exposed in json in a webapi or other mechanisms that might need different handling (hence why it is best practice to only sanitize and not encode in the database).

Now for html content is is slightly different:
We don't want to remove all tags but still sanitize for no scripts. There is a method for that in HtmlUtils.SanitizeHtmlIfNeeded.
I will merge this and do a new beta if you have existing data you can test this out with.