how to bypass htmlspecialchars