Add urlencode to request parameter

https://hackerone.com/reports/21081
Fix potential XSS

https://hackerone.com/reports/6843
Fix potential XSS

https://hackerone.com/reports/6853