Escape ampersand characters to the corresponding HTML entity

Fix applied to

* various module classes
* controller library

Signed-off-by: xchs <github@gmx.net>
Escape ampersand characters to the corresponding HTML entity

There were some unescaped ampersand characters when it comes to URL parameters, thus making the markup invalid.

Fix applied to

* various module classes
* Controller library

Signed-off-by: xchs <github@gmx.net>
Merge pull request #5928 from xchs/hotfix/escape-ampersand