fixed per code review

- follow PSR
- use htmlspecialchars