add htmlspecialchars to form fields