adding htmlspecchars to sanitizer