Moved htmlspecialchar escape from client to server side