Script injection fix

I fixed a problem with an XSS issue I found.
The fix is very simple, instead of creating the li element with the content inside, I first create the element, and then use jQuery's .text() function to set its text.

Example of exploit:
```javascript
$("#autocomplete").autocomplete({
    data: ['<img src="" onerror="alert(\'xss!\')"']
});
```
If the user enters "img" on the textbox, the javascript will be executed.