stat webserver: escape HTML characters

Log messages, queries, etc. would let HTML characters through unfiltered.

Fixes #1038.
Merge pull request #1039 from zeha/issue/1038

stat webserver: escape HTML characters