stat webserver: escape HTML characters

Log messages, queries, etc. would let HTML characters through unfiltered.

Fixes #1038.