[1661] Fix XSS in feedback comment display. Also added escaping for bbox, that looks unescaped too.