Kindly add Html::escape when you save config values to prevent sql injection