fix XSS in labels