Fixed #1918 - escape options in block drop downs #2174, thanks, @cycomachead !

for providing the fix

HISTORY.md

@@ -4,6 +4,7 @@
 
 ### 2018-10-05
 * Objects: Adjusted pen hue wrapping and took out pen shade wrapping
+* Store: Fixed #1918 - escape options in block drop downs #2174, thanks, Michael!
 
 ### 2018-10-04
 * GUI, Cloud: improved UX when running Snap! locally without a web server

snap.html

@@ -17,7 +17,7 @@
         <script type="text/javascript" src="src/symbols.js?version=2018-10-02"></script>
         <script type="text/javascript" src="src/sketch.js?version=2018-10-02"></script>
         <script type="text/javascript" src="src/xml.js?version=2018-10-02"></script>
-        <script type="text/javascript" src="src/store.js?version=2018-10-02"></script>
+        <script type="text/javascript" src="src/store.js?version=2018-10-05"></script>
         <script type="text/javascript" src="src/locale.js?version=2018-10-02"></script>
         <script type="text/javascript" src="src/cloud.js?version=2018-10-04"></script>
         <script type="text/javascript" src="src/sha512.js?version=2018-10-02"></script>

src/store.js

@@ -61,7 +61,7 @@ normalizeCanvas, contains*/
 
 // Global stuff ////////////////////////////////////////////////////////
 
-modules.store = '2018-October-02';
+modules.store = '2018-October-05';
 
 
 // XML_Serializer ///////////////////////////////////////////////////////
@@ -2023,9 +2023,10 @@ CustomBlockDefinition.prototype.toXML = function (serializer) {
                             ' readonly="true"' : '',
                     myself.declarations.get(decl)[1],
                     myself.declarations.get(decl)[2] ?
-                            '<options>' + myself.declarations.get(decl)[2] +
-                                '</options>'
-                                : ''
+                            serializer.format(
+                                '<options>@</options>',
+                                myself.declarations.get(decl)[2]
+                            ) : ''
                 );
             }, ''),
         this.body ? serializer.store(this.body.expression) : '',