Add test before using htmlspecialchars()

Signed-off-by: Marc Delisle <marc@infomarc.info>