add form functionality, with sanitization