security fixes

added esc_attr function to each variable displayed in form fields