Remove debugging code that can lead us to XSS injection, also pass variables through htmlspecialchars() to sanitize