replaced escaping function with htmlspecialchars

The escaping function could theoretically incorrectly escape input
sequences.