Preventing XSS injections on output for poll name by escaping html chars

Using $.text instead of $.html is escaping html characters from the inserted value