Added HTML escaping to SELECT tag