Perform output encoding

global xss filter may not always be enabled, prevent malicious user
input from being executed in the admin panel.