Apply un_htmlspecialchars($value) on all cases

and not just when using enclosed text

 #1755

Signed-off-by: Suki <suki@missallsunday.com>