escape XSS chars when editing name