properly escaping the form widget attributes