Fixes #3190 html and smarty code should be escaped in read-only mode

include/simpleplugin/class_attribute.inc

@@ -460,7 +460,7 @@ class Attribute
   {
     if ($this->visible) {
       if ($readOnly) {
-        $input = $this->getValue();
+        $input = '{literal}'.htmlentities($this->getValue(), ENT_COMPAT, 'UTF-8').'{/literal}';
       } elseif (is_object($this->plugin) && $this->plugin->is_template) {
         $input = $this->renderTemplateInput();
       } else {