Fixed Template name is not escaped

[TickTackk]

If you copy

<script>alert("meow")</script>

and paste it in title of a template, you will get a alert which I believe should be escaped before setting the title name in tabs.

 

[Mike]

This is fixed now, including a case where an error message would print it back unescaped. It doesn't appear that anything nefarious can be done though as the value can only be controlled by typing directly into the template title and the value can't actually be saved because it's not a valid template name.