this looks wrong. The charset should still be passed to ``htmlspecialchars``