Fixing Bug #8152

    - Posting of html only allowed if &allowhtml=`1` and eform field type is html
    - Prevent XSS by executing htmlspecialchars during formMerge on all form fields