if `label` is treated as HTML, then this is unsafe, as it could result in unsanitized user input being used as an HTML label.