It's a special character in HTML, which is the context in which the name is being shown. The fact that it's escaped before being concatenated into the HTML document is fine; the fact that it's triple-escaped is the problem.