fix duplicate htmlspecialchars of $sTmp; this comes straight from