Escape HTML code inside queries. Thanks to denstark for the report.