Just noticed that this touches the same lines of code I addressed in #3568, only this does not also address newline injections (log forgery attack), only html injections.

I must say, I like htmlEncoding better than my urlEncoding version, both for the simplicity in code and for readability in the logs, but in order to fully fix all issues including log injection you'd have to also escape newlines (\n, \r) in some manner.

Also have a look at the contract test coverage I added in my PR, completing coverage of the 2 controller classes. I think our PRs could be combined to form an even better solution.