shouldn't $column be escaped with htmlspecialchars() or a similar function?