Remove call to htmlspecialchars() and allow the callee to decide what to do with the resultant data (e.g. allow json_decode() if returning JSON)