Avoid XSS

Hi,
I added some calls to htmlspecialchars(), since some $_GET data is echo'ed.