Use escaping to prevent XSS rather than blocking unexpected requests.

Switch from blocking requests which may be the result of malformed links to escaping the content which is taken from request parameters and put into form fields.