fix(security): Prevent XSS in viewcard.php (refs #4844)