use htmlspecialchars to escape authorname