Apply un_htmlspecialchars() when showing or edited the user's data on custom profile fields

Signed-off-by: Suki <suki@missallsunday.com>