Move htmlspecialchars to form; pass actual value here.