escape() instead of String() to prevent XSS and ensure correct formatting

src/pages/_includes/ui/select.html

@@ -72,9 +72,9 @@
 				},
 				option: function(data,escape){
 					if( data.customProperties ){
-						return '<div><span class="dropdown-item-indicator">' + data.customProperties + '</span>' + String(data.text) + '</div>';
+						return '<div><span class="dropdown-item-indicator">' + data.customProperties + '</span>' + escape(data.text) + '</div>';
 					}
-					return '<div>' + String(data.text) + '</div>';
+					return '<div>' + escape(data.text) + '</div>';
 				},
 			},
 		}));