Improve output escaping, input sanitizing and logging

auto-approval.php

@@ -147,7 +147,7 @@ function vipgoci_auto_approval_non_approval(
 			'file_name' => $approved_file,
 			'file_line' => 1,
 			'issue'     => array(
-				'message'  => VIPGOCI_FILE_IS_APPROVED_MSG,
+				'message'  => vipgoci_output_html_escape( VIPGOCI_FILE_IS_APPROVED_MSG ),
 				'source'   => 'VipgociInternal.Info.ApprovedHashesToHashesAPI',
 				'severity' => 1,
 				'fixable'  => false,
@@ -240,7 +240,7 @@ function vipgoci_auto_approval_non_approval(
 			$options['repo-name'],
 			(int) $pr_item->number,
 			(int) $pr_item_review->id,
-			'Dismissing obsolete review; not approved any longer',
+			vipgoci_output_html_escape('Dismissing obsolete review; not approved any longer'),
 			$options['token']
 		);
 	}

github-api.php

@@ -2225,8 +2225,8 @@ function vipgoci_github_pr_reviews_dismiss_with_non_active_comments(
 				$options['repo-name'],
 				$pr_number,
 				$pr_review->id,
-				'Dismissing review as all inline comments ' .
-					'are obsolete by now',
+				vipgoci_output_html_escape( 'Dismissing review as all inline comments ' .
+					'are obsolete by now' ),
 				$options['token']
 			);
 		}

reports.php

@@ -544,6 +544,8 @@ function vipgoci_report_maybe_no_issues_found(
 
 		$no_issues_msg .= ' (commit-ID: ' . $commit_id . ')';
 
+		$no_issues_msg = vipgoci_output_html_escape( $no_issues_msg );
+
 		/*
 		 * If we have informational message, append it.
 		 */
@@ -1276,7 +1278,7 @@ function vipgoci_report_submit_pr_review_from_results(
 				$repo_name,
 				$github_token,
 				$pr_number,
-				VIPGOCI_GITHUB_ERROR_STR,
+				vipgoci_output_html_escape( VIPGOCI_GITHUB_ERROR_STR ),
 				$commit_id
 			);
 		}

svg-scan.php

@@ -138,7 +138,7 @@ function vipgoci_svg_look_for_specific_tokens(
 
 			$results['files'][ $temp_file_name ]['messages'][] =
 				array(
-					'message' => 'Found forbidden tag in SVG file: \'' . $disallowed_token . '\'',
+					'message' => vipgoci_output_html_escape( 'Found forbidden tag in SVG file: \'' . $disallowed_token . '\'' ),
 					'line'    => $line_no,
 					'level'   => 'ERROR',
 				);