Escape all user-entered data (fixes XSS holes)

Do not pass user-entered data directly into HTML

Signed-off-by: Sven Strickroth <email@cs-ware.de>
Do not use PHP_SELF

Use PATH_INFO instead.

Signed-off-by: Sven Strickroth <email@cs-ware.de>
Optimize for SSL-only setups

Signed-off-by: Sven Strickroth <email@cs-ware.de>