protect against embedded double quotes in form field vals