Sanitize html

@karlitschek This needs a backport to stable45 and stable4, I'm behind a proxy ATM that's why I can't cherry-pick it myself. Could you please do that? `p()` has been introduced with oC 5.0, so you have to use OC_Util::sanitizeHTML instead on stable45 and stable4.

\cc @karlitschek @DeepDiver1975 THX