Patched an XSS and SQL vulnerability.

Reported by security researcher Alain Homewood, PwC, NZ.
Updated Chyrp version number.
Merge remote-tracking branch 'origin/develop' into 2.6