bug #5175 : XSS flaw in a query parameter

Now the input parameter is encoded for its HTML rendering.
Don't forget to integrate also in 5.12.8-SNAPSHOT