testcase-stats, user-stats: SECURITY: input sanitization
    
    Add a bunch of missing input sanitization to testcase-stats,
    and improve user-stats' a bit. Both commands are vulnerable to
    XSS issues before this commit! Do not use older versions.