Call escapeHtml on SQL statements when generating catalog report