security patches, todos

* Fix:   info.php, recently_added.php: added input validations (m33x)
* Fix:   settings.php, user.php: XSS vulnerabilities (m33x)