htmlspecialchars flags fixed