Sanitize user input in renderers with htmlspecialchars()