<script type="text/javascript">
function formatar_mascara(src, mascara) {
var campo = src.value.replace(/\D/g, '');
var saida = mascara.substring(0, 1);
var texto = mascara.substring(campo.length);
if (texto.substring(0, 1) !== saida) {
src.value += texto.substring(0, 1);
}
}
</script>
<p>CPF: <input type="text" maxlength="14" name="cpf" style="width: 100px" value="<?php echo htmlspecialchars($cpf, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, "ISO-8859-1"); ?>" oninput="formatar_mascara(this, '###.###.###-##')" autofocus></p>