diff --git a/src/plugins/webreport/NarrativeWeb.py b/src/plugins/webreport/NarrativeWeb.py
index 5550d69be..e410bbb5a 100644
--- a/src/plugins/webreport/NarrativeWeb.py
+++ b/src/plugins/webreport/NarrativeWeb.py
@@ -61,6 +61,7 @@ from textwrap import TextWrapper
 from unicodedata import normalize
 from collections import defaultdict
 import re
+from xml.sax.saxutils import escape
 
 import operator
 from decimal import Decimal
@@ -202,11 +203,6 @@ CSS = PLUGMAN.process_plugin_data('WEBSTUFF')
 
 _html_dbl_quotes = re.compile(r'([^"]*) " ([^"]*) " (.*)', re.VERBOSE)
 _html_sng_quotes = re.compile(r"([^']*) ' ([^']*) ' (.*)", re.VERBOSE)
-_html_replacement = {
-    "&"  : "&",
-    ">"  : ">",
-    "<"  : "&#60;",
-    }
 
 # This command then defines the 'html_escape' option for escaping
 # special characters for presentation in HTML based on the above list.
@@ -214,24 +210,22 @@ def html_escape(text):
     """Convert the text and replace some characters with a &# variant."""
 
     # First single characters, no quotes
-    text = ''.join([_html_replacement.get(c, c) for c in text])
+    text = escape(text)
 
     # Deal with double quotes.
-    while 1:
+    m = _html_dbl_quotes.match(text)
+    while m:
+        text = "%s" "&#8220;" "%s" "&#8221;" "%s" % m.groups()
         m = _html_dbl_quotes.match(text)
-        if not m:
-            break
-        text = m.group(1) + '&#8220;' + m.group(2) + '&#8221;' + m.group(3)
     # Replace remaining double quotes.
     text = text.replace('"', '&#34;')
 
     # Deal with single quotes.
     text = text.replace("'s ", '&#8217;s ')
-    while 1:
+    m = _html_sng_quotes.match(text)
+    while m:
+        text = "%s" "&#8216;" "%s" "&#8217;" "%s" % m.groups()
         m = _html_sng_quotes.match(text)
-        if not m:
-            break
-        text = m.group(1) + '&#8216;' + m.group(2) + '&#8217;' + m.group(3)
     # Replace remaining single quotes.
     text = text.replace("'", '&#39;')