db4s: Escape another user supplied string, for safety

Author: justinclift

db4s/main.go

@@ -462,7 +462,7 @@ func licenceAddHandler(w http.ResponseWriter, r *http.Request) {
 	do := r.FormValue("display_order")
 	dispOrder, err := strconv.Atoi(do)
 	if err != nil {
-		http.Error(w, fmt.Sprintf("Invalid display order: %v", do), http.StatusBadRequest)
+		http.Error(w, fmt.Sprintf("Invalid display order: %v", html.EscapeString(do)), http.StatusBadRequest)
 		return
 	}