using htmlspecialchars to escape html special chars.