Added htmlspecialchars() to output field tags to prevent form attacks  NOTE: Always escape output