note need for escaping values in form fields