Escape choices before putting them in html

This prevents html/javascript injections by escaping as early as neccessary and
keeps the data in it's original form as long as possible.