prevent conde-injection through hostname or contact info with htmlentities function