Fix use of htmlspecialchars