fixed potential xss issue when one of the possible values for the autocomplete contains an html string