added missing htmlspecialchars