escape output. use selected() and checked() core functions where appropr...

...iate.