Security fix - html escape sql error messages