Updated php code to use htmlspecialchars for security