added htmlspecialchars to serverside