Fix possible XSS and use the xss() function in functions.php instead of
htmlentities in the preference stuff.