Add escaping to metabox

Even though most of these are currently known values, they could easily change in the future. It's just safer to always escape output.