Also, if the rows are returned in the order they're inserted,

your code will double-convert sequences like:

>

which should expand to:

>

but your code will convert to:

>

The & to & conversion must happen...

When you posted your article to the site, all your HTML escape codes were converted to their actual equivalents - so I see:

insert @htmltable values('&', '&')

instead of:

insert @htmltable values('&', '&')

(to...

Is there any reason why you used NVARCHAR(128) rather than SYSNAME?

SYSNAME would make the script more portable between versions - and enforce restrictions on content.