emergency HTML/JS injection fix.

found when looking at #6193, sanitation of status display input was missing everywhere.
unless i made a mistake this should be merged ASAP, even if it breaks a feature,
which can be fixed later.