missing html_encode calls