Fix broken input validation, properly escape untrusted data

PR #42 attempts to improve security, but reportedly broke the canvas graph style. Besides that, it seems band-aid. These patch series introduces defensive programming, it just escapes everything that is printed to avoid XSS should bugs occur.

There other major change is handling of commandline arguments. Instead of string concatenation, an array is used. When the actual command is built, all elements are shell escaped before concatenation and execution.

There are also some validation errors, in particular the host filter would allow any string due to a mistake in the regex character class. The width/height validation is tightened and there are also some other minor corrections.

In the perfect world, all `validate_get` crap gets dropped in favor of `filter_input()` with a corresponding filter/regex, but functionality-wise it works now so I did not touch that.