[BUGFIX] Add missing htmlspecialchars() and cleanup in EXT:recordlist