use warnings;
use strict;

use CGI qw/ escapeHTML /;

# this is the data you'd normally get from the DB
my @cols = ( "foo", "bar", "q\"><uz" );

print qq{<table>\n<tr>\n};
for my $col (@cols) {
	print qq{\t<td><input type="text" value="},
		escapeHTML($col), qq{"></td>\n};
};
print qq{</tr>\n</table>\n};

__END__
Output:

<table>
<tr>
	<td><input type="text" value="foo"></td>
	<td><input type="text" value="bar"></td>
	<td><input type="text" value="q&quot;&gt;&lt;uz"></td>
</tr>
</table>