Use the newly split Foundation Safe/SafeHTML filters to encode applicants data.
Migrate all existing applicant input to push through htmlentities.
Use the new SafeHTML filter for only those admin pages where HTML is allowed.