-<input type="hidden" name="phpath" value="{{$phpath}}" />
-<input type="hidden" name="dbhost" value="{{$dbhost}}" />
-<input type="hidden" name="dbuser" value="{{$dbuser}}" />
-<input type="hidden" name="dbpass" value="{{$dbpass}}" />
-<input type="hidden" name="dbdata" value="{{$dbdata}}" />
+<input type="hidden" name="phpath" value="{{$phpath|escape:'html'}}" />
+<input type="hidden" name="dbhost" value="{{$dbhost|escape:'html'}}" />
+<input type="hidden" name="dbuser" value="{{$dbuser|escape:'html'}}" />
+<input type="hidden" name="dbpass" value="{{$dbpass|escape:'html'}}" />
+<input type="hidden" name="dbdata" value="{{$dbdata|escape:'html'}}" />