html_escape all exception messages - pass query out-of-band if we want it formatted

core/exceptions.php

@@ -7,6 +7,11 @@
  */
 class SCoreException extends Exception
 {
+    public function __construct(string $msg, ?string $query=null)
+    {
+        parent::__construct($msg);
+        $this->query = $query;
+    }
 }
 
 /**