Add htmlspecialchars to stress that you shouldn't trust GET values