Convert password to htmlspecialchars