special_chars filter enabled on y1

y1 hosts gtk.php.net along with smarty, qa, bugs and master.  I looked
through the php-gtk-web code and there was absolutely no XSS protection
in there.  Instead of trying to fix it I enabled the filter.  If that
site needs raw user input for something, please add the appropriate
filter_input() calls.  If any of these other sites need raw input, we
can either turn off the filter for these, or add filter_input() calls.
Offhand I don't see where these other sites need it, but I could easily
have missed something.

-Rasmus