Escape format_match and format_item_display

This fixes an XSS vulnerability.