htmlspecialchars() some badge information

Before rendering badge information, we should escape it.
While it's unlikely that anything malicious will ever appear here from Tahrir, it's very possible that badge names can contain e.g., quotes, which would render invalid html.

This commit prevents that by escaping said characters.