Use htmlspecialchars to prevent attacks