Fix a possible XSS

htmlentities could be bypassed with UTF-7