bug #5175 : XSS flaw in a query parameter

Now the input parameter is encoded for its HTML rendering