Remove htmlentities()

I don't think we need `htmlentities()` here as the data is received from a trusted source.