check that every invocation of htmlspecialchars has the right arg list