Fix XSS in graph page

[thelmstedt]

In this context graphName is rendered inside a <script></script> block, so we need to htmlEncode to avoid XSS vulnerabilities like: /monitoring?part=graph&graph=usedMemory<%2fscript><script>alert(1)<%2fscript>

[thelmstedt]

This came up in an internal pentest. It seems this path controls the rendering of graphs/sql/errors, which covers my usecases. I'm unsure if the fix needs to be applied anywhere else.

[evernat]

ok thanks