* using htmlspecialchars() for safe XHTML output