Fix XSS in select2 formatter