Here it caught my eyes but be elsewhere that you are using the GET argument as passed from the user and it might lead to some actions performed with javascript.

You already use htmlspecialchars above why not use that var?