missing `htmlspecialchars` around the variables getting concatenated here (would lead to problems in case `>` etc. is used in a e.g. error message)