You should probably be running ```$report_email``` through ```html::escape()``` just in case.. even if it can only be set by an admin..