Fixed potential security issues

1. There are missing `CHtml::encode` calls potentially allowing to perform XSS.
2. When working with `mb_` one should specify encoding.