refactor: sanitize dynamic outputs to prevent reflected xss

[deepsource-dev-autofix]

This PR hardens the application against reflected Cross-Site Scripting (XSS) vulnerabilities by ensuring all user-supplied and dynamic data is properly escaped before being rendered into HTML.

Changes include:

• Reflected XSS: Previously, various template and echo statements output unescaped variables (e.g., page bodies, thread entries, form inputs, and report values), which could be manipulated to inject malicious scripts. Each occurrence has been wrapped with htmlspecialchars (or Format::htmlchars) using ENT_QUOTES and UTF-8 to ensure both single and double quotes are encoded and the document encoding is enforced. Please verify that the application consistently uses UTF-8, as this escaping assumes that character set.

No additional security configuration was added or modified in this PR.

This Autofix was generated by AI. Please review the change before merging.