You're definitely right. I thought we didn't need to encode the heading, but we do. The `$html_output` is being encoded, too, at the previous lines. Thanks!