use htmlspecialchars with 4th arg set to false