Fixing bug in form_hidden and form_open

When string containing quotes i.e. json or serialized object was passed as  $hidden => form_open or as a $value => form_hidden it wasn't escaped properly.

i.e.:   form_hidden('aaa', '{"foo":"bar"}') or wasn't work

Author: nowackipawel

system/Helpers/form_helper.php

@@ -92,7 +92,7 @@ function form_open(string $action = '', $attributes = [], array $hidden = []): s
 		{
 			foreach ($hidden as $name => $value)
 			{
-				$form .= '<input type="hidden" name="' . $name . '" value="' . $value . '" style="display: none;" />' . "\n";
+				$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value,'html') . '" style="display: none;" />' . "\n";
 			}
 		}
 
@@ -171,7 +171,7 @@ function form_hidden($name, $value = '', bool $recursing = false): string
 
 		if ( ! is_array($value))
 		{
-			$form .= '<input type="hidden" name="' . $name . '" value="' . $value . "\" />\n";
+			$form .= '<input type="hidden" name="' . $name . '" value="' . esc($value,'html') . "\" />\n";
 		}
 		else
 		{