passi la stringa in htmlspecialchars($stringa_da_convetire);