fix XSS vulnerability

it is possible to inject Javascript into the output if userinput is used as
breadcrumb label (like in the last example). this should be prevented by
escaping all input.