fix(security): Prevent XSS in viewcard.php (closes #4917)(closes #4872)