added htmlspecialchars to tackle XXS attacks.