Improve test coverage
Use htmlentities() instead of htmlspecialchars() to escape redirect data