As Brion points out, this needs an htmlspecialchars.