Added htmlspecialchars() call to prevent script injections