escape html when setting selected item to prevent xss