Fix yet another bad htmlspecialchars() call

Change-Id: I75073b0934d6fc2702a6dca86c9bd11c8767edcf