form: fixed htmlspecialchars issue