[security] prevent xml injection and executing switch api cmds (#6594)

resources/classes/xml.php

@@ -0,0 +1,16 @@
+<?php
+
+if (!class_exists('xml')) {
+    class xml {
+
+        /**
+         * Escapes xml special characters to html entities and sanitze switch special chars.
+         */
+        static function sanitize($string) {
+            return str_replace('$', '', htmlspecialchars($string, ENT_XML1));
+        }
+
+    }
+}
+
+?>