$h = htmlspecialchars($_GET['h'], ENT_QUOTES, '');