use HTML escaping in RSS template, fixes #21

lib/philomena_web/controllers/api/rss/watched_controller.ex

@@ -6,6 +6,8 @@ defmodule PhilomenaWeb.Api.Rss.WatchedController do
   def index(conn, _params) do
     {:ok, {images, _tags}} = ImageLoader.search_string(conn, "my:watched")
 
-    render(conn, "index.rss", images: images)
+    # NB: this is RSS, but using the RSS format causes Phoenix not to
+    # escape HTML
+    render(conn, "index.html", layout: false, images: images)
   end
 end

lib/philomena_web/templates/api/rss/watched/index.html.eex

@@ -8,7 +8,7 @@
 
     <%= for image <- @images do %>
         <item>
-          <title><%= "##{image.id} - #{image.tag_list_cache}" %></title>
+          <title>#<%= image.id %> - <%= image.tag_list_cache %></title>
           <description>
             <![CDATA[
               <% mouseovertext = "Size: #{image.image_width}x#{image.image_height} | Tagged: #{image.tag_list_cache}" %>