Please use htmlspecialchars() to prevent malicious code to be passed to parameter