value="$!escapetool.xml($request.originalpassword)"

The passwords could contain `"`. Same for the other inputs.