Use HTML parse mode and properly escape stuff

bot.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 import asyncio
+import html
 from os import environ
 from collections import namedtuple
 
@@ -19,12 +20,13 @@ logger = logging.getLogger(__name__)
 Xkcd = namedtuple('Xkcd', ['title', 'link', 'transcript', 'alt', 'number'])
 
 URL_FMT_STR = "http://www.ohnorobot.com/index.php?Search=Search&comic=56&s={}"
-# FIXME HTML parsemode + escaping
-MSG_FMT_STR = "[{number}]({link}): **{title}**\n\n__{alt}__"
+MSG_FMT_STR = '<a href="{link}">{number}</a>: <b>{title}</b>\n\n<i>{alt}</i>'
 XKCD_JSON_FMT_STR = "https://xkcd.com/{}/info.0.json"
 MAX_SEARCH_RESULTS = 10
 
 bot = TelegramClient('xkcd', 6, 'eb06d4abfb49dc3eeb1aeb98ae0f581e')
+bot.parse_mode = 'html'
+
 session = None  # set later
 
 # blockquote element -> Xkcd
@@ -85,7 +87,12 @@ async def inlinequery(event):
     result = await asyncio.gather(*(builder.article(
         title=xkcd.title,
         url=xkcd.link,
-        text=MSG_FMT_STR.format(number=xkcd.number, link=xkcd.link, title=xkcd.title, alt=xkcd.alt)
+        text=MSG_FMT_STR.format(
+            number=xkcd.number,
+            link=xkcd.link,
+            title=html.escape(xkcd.title),
+            alt=html.escape(xkcd.alt)
+        )
     ) for xkcd in await get_xkcds(event.text)))
 
     # FIXME get_xkcds returns duplicates, which lead to the same result ID