Properly escape htmlchars in field errors