use h() instead of htmlspecialchars()