arguments passed to vtext.php are not escaped

Create user "Chip & Dale". Go to "Administration" -> "Notifications". Observe chipndale.png. This happens because "Chip & Dale" is inserted into the helper URL unescaped: new CImg('vtext.php?text='.$user_data['alias'].$vTextColor).