HtmlArmor: Pass ENT_QUOTES to htmlspecialchars()