Docs: Fix escaping in HTML escaping example

[Badhreesh]

The code in the Quickstart's HTML Escaping section does not render name=<script>alert("bad")</script> to text because the slash in </script> gets interpreted as a trailing slash, leading to a 404.

Getting the name as a query parameter instead allows:

1. the script tag to be rendered as text if HTML escaping is done
2. the alert in the script tag to be executed if HTML escaping is not done.

[Badhreesh]

@davidism, I realized that for docs changes I should've made the PR from the stable branch. I've closed the previous PR and made a new one pointing to the correct branch.

[davidism]

I wonder if there's a way to demonstrate the issue using the existing url, rather than changing to the path type, which doesn't really make sense in this context. Either using something like <img> that doesn't require a closing tag, or taking the argument from request.args?

[Badhreesh]

I wonder if there's a way to demonstrate the issue using the existing url, rather than changing to the path type, which doesn't really make sense in this context. Either using something like <img> that doesn't require a closing tag, or taking the argument from request.args?

I agree. Since the emphasis on escaping is to prevent the execution of scripts, I went ahead with using request.args to ensure correct demonstration of the issue.