Use `htmlspecialchars` rather than `htmlentities`