Escape with htmlspecialchars()
Fix buildUser() email.