Fix potential XSS vulnerability on user's name

Add other locations as well a failsafe for the `htmlentities()` call