Use htmlspecialchars instead of htmlentities
More restrictions on username