HTML escape user input on confirmation page