updated htmlspecialchars usage