Small bugfix -- we already called htmlentities when encoding the string.
Only htmlspecialchars needed at this point.