[TASK] Properly escape all form attributes in SetupModuleController