Add the tool.php to do testing

Fix missing htmlentities() calls - thanks to Stephen
Switch to htmlspecialchars