select: escape label

Author: ext

CHANGELOG.md

@@ -1,3 +1,9 @@
+# 1.4.2
+
+## Bugfixes
+
+  - Select now escapes label again. (backported from 1.5)
+
 # 1.4.1
 
 ## Bugfixes

src/lib/FormSelect.php

@@ -68,7 +68,7 @@ public function add($value, $text, $attr=array()) {
 			$attr['selected'] = 'selected';
 		}
 		$attr['value'] = $value;
-
+		$text = htmlspecialchars($text);
 		$this->options[] = "<option " . $this->serialize_attr($attr) . ">$text</option>";
 	}