you also need `htmlspecialchars` for `$title`