fixes #5471 html escape auto-completer values (CVE-2014-0208)