price_ListRules & cat_Params: bugFix HTML injection