Escape fields against HTML (#40)