use htmlspecialchars

as seen in https://github.com/jihaisse/indieAuth-links/issues/1