Protect against HTML injection

This makes sure that code generating HTML will validate its parameters
and/or use proper escaping to protect against HTML injection.
Merge branch 'injection-protection'