[BUGFIX] Add missing htmlspecialchars() calls and cleanup in QueryView