added htmlspecialchars to the finalize method