you also need `htmlspecialchars` for $th