Needed htmlentities() to prevent <script> injection