Root cause is that arguments passed to mk_option() should be sanitized via htmlspecialchars().