There is no need to pass a @-placeholder to htmlspecialchars(); that is already done by Drupal core.
Fixed
1.0
Code