"<script>alert('Hello');</script>"

function input_tag($name, $value = null, $options = array())
{
  if ($value === null && isset($options['type']) && $options['type'] == 'password')
  {
    $value = null;
  }
  else if (($reqvalue = _get_request_value($name)) !== null)
  {
    $value = $reqvalue;
  }

  return tag('input', array_merge(array('type' => 'text', 'name' => $name, 'id' => $name, 'value' => $value), _convert_options($options)));
}

    $value = $reqvalue;

    $value = htmlspecialchars($reqvalue);

function _tag_options($options = array())
{
  $options = _parse_attributes($options);

  $html = '';
  foreach ($options as $key => $value)
  {
//    $html .= ' '.$key.'="'.$value.'"';
//    $html .= ' '.$key.'="'.htmlentities($value).'"';
    $html .= ' '.$key.'="'.htmlspecialchars($value).'"';
  }

  return $html;
}