fix XSS reported by Janek Vind
add Changelog item for XSS found by Janek Vind, fixed in commit 79089c9bc02c82c15419fd9d6496b8781ae08a5a
improve coding style : echo does not need parenthesis