Oops, forgot two instances of htmlspecialchars()