wrap player names in htmlspecialchars() so HTML tags are not interpreted