Escaping potential user input in form controls