htmlspecialchars -> htmlentities, use ENT_QUOTES

Standardize on how I’m doing this at each XSS vector.