Create a new report from SQL, enter the following as the SQL: select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>' Save the report, and Koha complains "whatever: The authorized value category (NON_EXISTENT_AUTHVAL) you selected does not exist.", with some random garbage characters on the screen. The garbage happens because part of the page HTML looks like this: <input type='hidden' name='sql' value='select * from items where itemnumber = '<<whatever|NON_EXISTENT_AUTHVAL>>' ' /> This is obviously wrong, the sql in there should be html encoded.
Already fixed in master.