fix XSS vulnerability

it is possible to inject JS into the output if userinput is used as
breadcrumb label (like in the last example). this should be prevented by
escaping all input.