Fix XSS vulnerabilities

Added htmlEncode to a parameter in a template missed before.