Encode urls with htmlspecialchars

Should close #23