* Add missing HTML/url encoding (5245-chunk12) Was reports that some missing HTML encoding could lead to XSS/javascript injection. Reviewable chunk of #5245 , which grew too large.