Add a escape to city label in template.

XSS