& " into safe text before printing $safeName = htmlspecialchars($name, ENT_QUOTES, 'UTF-8'); echo "

Thank you, {$safeName}!

"; echo '

We will reply to you by email.

'; } else { foreach ($errors as $error) { echo '

' . htmlspecialchars($error) . '

'; } }